{"schema_version":"1","data":[{"id":19309,"advisory_id":"b40893d0-7014-4be0-ad4c-991d38d7a9f9","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/368","source_published_at":"2026-10-24T09:22:02+00:00","published_at":"2026-10-25T02:14:23.258424+00:00","extraction_method":"llm","technologies":["jxrlib","mircomir-jxrlib","oss-security"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"jxrlib memory bugs in damaged JPEG XR files","summary":"Multiple memory-safety bugs can be triggered by damaged JPEG XR files. The maintained mircomir/jxrlib fork fixes them in version 1.4.4; older versions remain in several distributions and products.","evidence":"All of them are fixed in public in the maintained fork github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)","products":[{"name":{"value":"mircomir/jxrlib","evidence":"the maintained fork github.com/mircomir/jxrlib"},"prerequisites":[],"fixed_versions":[{"value":"1.4.4","evidence":"github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)"}],"affected_versions":[]},{"name":{"value":"jxrlib","evidence":"jxrlib, Microsoft's JPEG XR library"},"prerequisites":[{"value":"a damaged JPEG XR file","evidence":"a damaged JPEG XR file of a few hundred bytes triggers"}],"fixed_versions":[],"affected_versions":[{"value":"1.2~git20170615.f752187-5.3","evidence":"Debian's 1.2~git20170615.f752187-5.3"}]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19309,"next_before":19309}